Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe
-
Size
4.6MB
-
MD5
49cfa73d7dd2fe362a914b4bb628d174
-
SHA1
ee9aab3efbb85a3ccdc2ec33953469cd9a4a7067
-
SHA256
d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a
-
SHA512
c41aadb4a176923734df9705f0c473b982f4ce0da7c400a408091e2ad8f9117a8dc0cc25b8b27c8236e5d2f0692defcc415bd5ea47b51bb7e8dc09930a18c8ae
-
SSDEEP
98304:yOySfRmDk7aphPPUqCjqeBwgKX19iNFg5h1GDVCo:yOFLepcB1aqqBIVJ
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe 2540 MsiExec.exe 2540 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\M: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\V: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\K: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\R: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\Y: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\Q: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\Z: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\P: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\S: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\N: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\T: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\W: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\X: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\E: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\J: d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe File opened (read-only) \??\S: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2520 msiexec.exe Token: SeTakeOwnershipPrivilege 2520 msiexec.exe Token: SeSecurityPrivilege 2520 msiexec.exe Token: SeCreateTokenPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeAssignPrimaryTokenPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeLockMemoryPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeIncreaseQuotaPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeMachineAccountPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeTcbPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSecurityPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeTakeOwnershipPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeLoadDriverPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSystemProfilePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSystemtimePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeProfSingleProcessPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeIncBasePriorityPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeCreatePagefilePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeCreatePermanentPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeBackupPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeRestorePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeShutdownPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeDebugPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeAuditPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSystemEnvironmentPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeChangeNotifyPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeRemoteShutdownPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeUndockPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSyncAgentPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeEnableDelegationPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeManageVolumePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeImpersonatePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeCreateGlobalPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeCreateTokenPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeAssignPrimaryTokenPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeLockMemoryPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeIncreaseQuotaPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeMachineAccountPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeTcbPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSecurityPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeTakeOwnershipPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeLoadDriverPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSystemProfilePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSystemtimePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeProfSingleProcessPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeIncBasePriorityPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeCreatePagefilePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeCreatePermanentPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeBackupPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeRestorePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeShutdownPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeDebugPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeAuditPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSystemEnvironmentPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeChangeNotifyPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeRemoteShutdownPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeUndockPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeSyncAgentPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeEnableDelegationPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeManageVolumePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeImpersonatePrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeCreateGlobalPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeCreateTokenPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeAssignPrimaryTokenPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe Token: SeLockMemoryPrivilege 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2540 2520 msiexec.exe 31 PID 2520 wrote to memory of 2540 2520 msiexec.exe 31 PID 2520 wrote to memory of 2540 2520 msiexec.exe 31 PID 2520 wrote to memory of 2540 2520 msiexec.exe 31 PID 2520 wrote to memory of 2540 2520 msiexec.exe 31 PID 2520 wrote to memory of 2540 2520 msiexec.exe 31 PID 2520 wrote to memory of 2540 2520 msiexec.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe"C:\Users\Admin\AppData\Local\Temp\d167da473d0818f428f0c3e34e17c195c6d3b6259c788beca1be3a743675844a.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2676
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD81867D4E5E1C32B6DD96330EC259A1 C2⤵
- Loads dropped DLL
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5abf1076064505dee794fa7aed67252b8
SHA1358d4e501bb3007feece82a4039cc1050f23fab4
SHA256fb0d133f05de6aa6a7a3491ae532191a60c438b35d9ff7bfec9e63131f6f0c73
SHA5129a4680a8d186c1d7550b5e03cbdd095b0c88b2e0249a3af75fa0253d2c9a6f0aa1dd570ecf1a273683a14e6c7b5fb11678be3da439a3bf23eab790372e96e321
-
Filesize
632KB
MD59b4b4ea6509e4db1e2a8f09a7c6f8f04
SHA1512880abe3c9696edb042599bd199f1d05210aa2
SHA2563774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94
SHA51263b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608
-
Filesize
2.5MB
MD57a692fda0f2c720ff84d8e90a2b21d48
SHA1e69d224db0d3d88fb39efe3668eabb17a3ec33b4
SHA256b13cc76c6150b78be34a81df40069b3b53afb97162d808a3a92f33c3cdc3bb14
SHA512eefcf56538339252ae3be0366ed7cbdee8a3915d0a98a3cf7c8bb0ace72f62d61fa30db3671d972acb79a7f7975991badc6a3151eae69e98a821394da21d3836
-
Filesize
215KB
MD5c098b1c216866d9ca0eeae0a46a46a0a
SHA1b68890ebc6af792cac62ab0e2ade6a7b777c58ae
SHA2560960f28f586617647f16ccb2ad9b38fba521605015a4c51f661d4bceca251db0
SHA512fac75162310f554baccb49b5b88ebceaa8b288e7aca010e0b364077dd2738cd0d484633bef7270fad064813a7b01b7d26e000c0561d20925fa5a6ea902d452e6
-
Filesize
550KB
MD50dd1f1ff906c4d1fc7ad962e994cad7f
SHA14d1549cf7ef6a63baf83280143d7797d4df4fa2d
SHA256140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588
SHA5128d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb
